Logon script - Sharing

[Dageezah]

Since it is Christmas, time of good will and all that, I have decided to share some interesting ideas with you guys in the hope that if anyone else has any good logon ideas they will post back.

 

This will populate the Computer description in AD with the current logged on user (along with time logged on) then in the location field it will put the last user who logged on.

 

Logon.vbs

 

Set objSystemInfo = CreateObject("ADSystemInfo") 
strDomain = objSystemInfo.DomainShortName
set objNetwork = createobject("Wscript.Network")
strComputer = objNetwork.ComputerName
strUserName = objNetwork.UserName
strComputerDN = getComputerDN(strComputer,strDomain)
Set objComp=GetObject("LDAP://" & strComputerDN)
if instr(objComp.Description,UCase(strUserName)) = 0 then
objComp.Location = objComp.Description				
End if
objComp.Description = "Logged On : " & Now & " - " & UCase(strUserName)
objComp.SetInfo

 

Logoff.vbs

 

Set objSystemInfo = CreateObject("ADSystemInfo") 
strDomain = objSystemInfo.DomainShortName
set objNetwork = createobject("Wscript.Network")
strComputer = objNetwork.ComputerName
strUserName = objNetwork.UserName
strComputerDN = getComputerDN(strComputer,strDomain)
Set objComp=GetObject("LDAP://" & strComputerDN)
objComp.Description = replace(objComp.Description,"-",", Logged Off : " & now & " - ")
objComp.SetInfo

[altecsole]

We do something similar, but we write logon and logoff entries to a couple of mysql databases. This enables us to check who's currently logged on, and also look at logon history.

[ezzauk]

We do something similar, but we write logon and logoff entries to a couple of mysql databases. This enables us to check who's currently logged on, and also look at logon history.

 

Any chance i can get a copy of them scripts, i like the idea of inserting these into a mysql db.

[natm]

We have a server running Splunk to store our logs, its got a really nice interface. All servers then have Snare installed, its configured to turn the Windows event logs into syslog and send them to Splunk.

 

Splunk is like google for our event logs, I've setup reports for finding who has logged in in the last 30mins, what documents are being printed, password changes, connections to our VPNs etc. It also produces nices graphs so you can see trends. The free version does the job just fine

 

Nat

[altecsole]

Any chance i can get a copy of them scripts, i like the idea of inserting these into a mysql db.

 

Okay, to use these scripts you need to setup your tables in mysql and also install the mysql odbc drivers on your workstations. The odbc drivers are in msi format, so we deploy via Group Policy. These logon and logoff scripts are written for Windows XP 32-bit, they should work on 32-bit Vista and Windows 7, but will need tweaking for 64-bit versions of these OS.

 

The scripts are specific to our domain; you will need to manually edit them to use the details for your network, in particular the name of your mysql server, the database and table names and the user name and password that will be used to read and update the mysql tables.

 

This system for recording logon and logoff events was developed over a period of time and you'd probably want to change how it's done. You might want a single database with a couple of tables, for exammple, instead of seperate databases. I'm not saying this is the only way, or even the best way, I just know it works for us.

 

Current Logons

These are stored in a database called 'network' in a table called 'logon'. This table has two columns called 'computer' and 'user'; both of these have the datatype 'text'.

 

The current logons table has the user added to it at logon, and deleted from it at logoff. This gives us an easy way to check for currently logged on users.

 

Logon History

These are stored in a database called 'logonrecord' in a table called 'history'. This table has five columns ('computer'(text), 'user'(text), 'action'(text), 'date'(date), 'time'(time)).

 

Logon and logoff events are written to this database enabling us to have an accurate record of when users logged on and off computers.

 

Logons/logoff scripts

There are two scripts; one for logon and one for logoff. We have these set via group policy. This allows us to easily update the scripts if required.

 

AddLogon4.vbs

Runs at logon. Adds current logged on user to database (removing any previous entry). Adds logon event to logon history database.

DelLogon.vbs

Runs at logoff. Deletes current logged on user from database. Adds logoff event to logon history database.

 

Query scripts

We have two command line batch files that call vbscripts to query the databases for logon information. The advantage of using this method is that you can update the versions of your vbscript without affecting how users run it and also you can specify the use of cscript when running your vbscript file. The wildcard character when searching for users or computers is the percentage sign (%)

 

loggedonv4.vbs - called by a cmd line file (loggedon.cmd - cscript loggedonv4.vbs %1) takes two arguments; /c for computer or /u for user. Eg.. loggedon /c:it6-02 for who's logged on to a single computer, or /c:it6-% to see who's logged on to all the computers in IT6. Same for users; loggedon /u:05amy_jones to see what computer/s Amy is logged on to, or /u:05% to see where all of Year12 are logged on.

 

logonhistoryv3.vbs - called by a cmd line file (logonhistory.cmd - cscript logonhistoryv3.vbs %1 %2) this uses /c and /u in the same wasy as loggedon.vbs, but also includes the date to check using the /d switch. Example, logonhistory /c:it6-25 /d:2010-12-16. Note: the date format must be YYYY-MM-DD. To use today's date you can use /d:today

 

For querying history for a range of dates we use a webpage written in php, as this uses a date picker to make things easier for our less technically minded users.

 

LoggedOnTidy.vbs

Sometimes computers get turned off without the user logging off, or the network goes down for some reason. This can leave orphaned entries in the current logged on users table. To fix this I run this vbscript as a scheduled task ever three hours. It firstly checks if computers are on by using ping, if they're not then the user can be deleted from the databae. If the computer is on, the script checks the computer registry for the locally logged on user (if any), compares this to entries in the database and deletes any that aren't valid. Results are written to a text file (called LoggedOnEvents.txt) so you can keep an eye on things.

DelLogonv4.vbs

AddLogonv4.vbs

LoggedOnTidy2.vbs

LogonHistoryv3.vbs

Loggedonv4.vbs